FreeBSD 7.1服务器反复重起

leix

一台HP PL380 G3服务器，两月前安装了FreeBSD7.1，服务器上跑了ssh2、vsftpd、apache、mysql，一直正常运行。本周一公司停了两次电，服务器起来后找不到httpd，手工启动报告httpd已启动，80端口被占，再次重起服务器httpd正常启动。
今天服务器出现每隔3~5分钟就重起一次的现象，dmesg里除了报告WARNING: / was not properly dismounted等信息，其它没有任何异常。查看auth.log也没有异常情况。
请教，如何查找问题所在？只知道隔3~5分钟就重起一次肯定是不正常的。

llzqq

先检查硬件有无问题

macafee

先单用户模式作FSCK吧。

leix

硬件查了，内存、硬盘没有问题。但用户模式fsck也做了。现在查看昨晚的messages，发现服务器大约1小时重起一次，重起前受到过ARP攻击。

#cat /var/log/messages | grep "May 22"
May 22 00:29:08 www kernel: arp: 00:13:46:85:86:58 attempts to modify permanent entry for 192.168.1.4 on bge0
May 22 00:59:08 www kernel: arp: 00:13:46:85:86:58 attempts to modify permanent entry for 192.168.1.4 on bge0
May 22 01:01:42 www syslogd: kernel boot file is /boot/kernel/kernel
May 22 01:01:42 www kernel: Copyright (c) 1992-2009 The FreeBSD Project.
May 22 01:01:42 www kernel: Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
May 22 01:01:42 www kernel: The Regents of the University of California. All rights reserved.
May 22 01:01:42 www kernel: FreeBSD is a registered trademark of The FreeBSD Foundation.
May 22 01:01:42 www kernel: FreeBSD 7.1-RELEASE #1: Tue Mar 24 17:40:31 CST 2009
.
.
.
May 22 01:04:25 www fsck: /dev/da0s1d: Reclaimed: 0 directories, 7 files, 2 fragments
May 22 01:04:25 www fsck: /dev/da0s1d: 1079 files, 34632 used, 978381 free (789 frags, 122199 blocks, 0.1% fragmentation)
May 22 01:29:07 www kernel: arp: 00:13:46:85:86:58 attempts to modify permanent entry for 192.168.1.4 on bge0
May 22 01:59:07 www kernel: arp: 00:13:46:85:86:58 attempts to modify permanent entry for 192.168.1.4 on bge0
May 22 02:01:41 www syslogd: kernel boot file is /boot/kernel/kernel
May 22 02:01:41 www kernel: Copyright (c) 1992-2009 The FreeBSD Project.
May 22 02:01:41 www kernel: Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
May 22 02:01:41 www kernel: The Regents of the University of California. All rights reserved.
May 22 02:01:41 www kernel: FreeBSD is a registered trademark of The FreeBSD Foundation.
May 22 02:01:41 www kernel: FreeBSD 7.1-RELEASE #1: Tue Mar 24 17:40:31 CST 2009
.
.
.
May 22 02:04:23 www fsck: /dev/da0s1d: Reclaimed: 0 directories, 7 files, 2 fragments
May 22 02:04:23 www fsck: /dev/da0s1d: 1079 files, 34642 used, 978371 free (787 frags, 122198 blocks, 0.1% fragmentation)
May 22 02:29:07 www kernel: arp: 00:13:46:85:86:58 attempts to modify permanent entry for 192.168.1.4 on bge0
May 22 02:59:07 www kernel: arp: 00:13:46:85:86:58 attempts to modify permanent entry for 192.168.1.4 on bge0
May 22 03:01:42 www syslogd: kernel boot file is /boot/kernel/kernel
May 22 03:01:42 www kernel: Copyright (c) 1992-2009 The FreeBSD Project.
May 22 03:01:42 www kernel: Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
May 22 03:01:42 www kernel: The Regents of the University of California. All rights reserved.
May 22 03:01:42 www kernel: FreeBSD is a registered trademark of The FreeBSD Foundation.
May 22 03:01:42 www kernel: FreeBSD 7.1-RELEASE #1: Tue Mar 24 17:40:31 CST 2009
.
.
.
May 22 03:04:24 www fsck: /dev/da0s1d: Reclaimed: 0 directories, 7 files, 2 fragments
May 22 03:04:24 www fsck: /dev/da0s1d: 1079 files, 34643 used, 978370 free (786 frags, 122198 blocks, 0.1% fragmentation)
May 22 03:29:06 www kernel: arp: 00:13:46:85:86:58 attempts to modify permanent entry for 192.168.1.4 on bge0
May 22 03:59:06 www kernel: arp: 00:13:46:85:86:58 attempts to modify permanent entry for 192.168.1.4 on bge0
May 22 04:01:42 www syslogd: kernel boot file is /boot/kernel/kernel
May 22 04:01:42 www kernel: Copyright (c) 1992-2009 The FreeBSD Project.
May 22 04:01:42 www kernel: Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
May 22 04:01:42 www kernel: The Regents of the University of California. All rights reserved.
May 22 04:01:42 www kernel: FreeBSD is a registered trademark of The FreeBSD Foundation.
May 22 04:01:42 www kernel: FreeBSD 7.1-RELEASE #1: Tue Mar 24 17:40:31 CST 2009
.
.
.

leix

现在服务器每隔1小时重起一次，服务器的IP是192.168.1.158，网关192.168.1.4，网关MAC：00:13:46:85:86:58，服务器上已经把网关IP/MAC做了绑定。
服务器重起半小时后，收到一次00:13:46:85:86:58伪装成网关192.168.1.4的arp包，一小时后又收到一次，然后就重起了。

请教大家为什么服务器会重起？如何解决问题？
注：我在内网中找不到00:13:46:85:86:58这台机器

zhengwei_zw

不要网络要重启吗？

congli

就算ARP攻击也没那么差吧.

lsstarboy

原帖由 zhengwei_zw 于 2009-5-28 22:31 发表
不要网络要重启吗？

这个可以试一下。停网一小时，sshd两小时后启动或重启后启动。

再可以测试一下硬件。起码用memtest测试一下内存，ports里很多测试软件。